Exam Bundle

This action is appropriate for a different case: A custom compliance PowerShell script prints debugging prose before JSON output and Intune cannot parse the device evaluation. There, the targeted fix is 'Return the supported JSON schema without extra stdout content and validate the rules file.' because machine-readable output format is part of the custom compliance contract. The current scenario instead requires 'Distinguish transport errors from valid empty results and retry within a bounded policy.' and verification that a transient simulated failure is reported or recovered without returning false zero devices.

This action is appropriate for a different case: An administrator wants to extend device compliance using PowerShell but the custom script is assigned to unsupported macOS targets. There, the targeted fix is 'Scope custom compliance discovery to supported device platforms and policy prerequisites.' because a valid script on Windows need not be a valid macOS compliance mechanism. The current scenario instead requires 'Distinguish transport errors from valid empty results and retry within a bounded policy.' and verification that a transient simulated failure is reported or recovered without returning false zero devices.

This action is appropriate for a different case: A Policy Configuration Agent proposes settings from a natural-language security standard without identifying policy conflicts. There, the targeted fix is 'Review proposed settings and existing Intune assignments before creating the new configuration.' because generated policy recommendations should be assessed for platform support and conflict. The current scenario instead requires 'Distinguish transport errors from valid empty results and retry within a bounded policy.' and verification that a transient simulated failure is reported or recovered without returning false zero devices.

This observation would validate a different case: A corporate iPhone user removes Company Portal and expects the supervised automated enrollment state to disappear. It would check 'After app removal the test device remains supervised and applicable MDM policy stays intact.' after 'Explain and manage corporate supervision through Apple automated enrollment rather than app removal.'. It does not establish success for the stated scenario; the needed evidence is 'The user retains personal data and an admin can remove only the approved company-managed data.'.

This observation would validate a different case: A mobile administrator tries to use the same Apple enrollment profile for personally owned and corporate supervised iPhones. It would check 'The personal device enrolls with user-appropriate controls while the corporate device is supervised.' after 'Create separate BYOD and corporate enrollment models with the appropriate privacy and supervision behavior.'. It does not establish success for the stated scenario; the needed evidence is 'The user retains personal data and an admin can remove only the approved company-managed data.'.

This observation would validate a different case: An enrollment error appears during iPad provisioning immediately after the Apple enrollment token was refreshed, but the profile assignment is missing. It would check 'The iPad receives its intended company enrollment profile during a clean setup.' after 'Check the token synchronization and automated enrollment profile mapping for the actual device.'. It does not establish success for the stated scenario; the needed evidence is 'The user retains personal data and an admin can remove only the approved company-managed data.'.

This action is appropriate for a different case: A bring-your-own Android user accidentally enrolls the whole phone instead of a separate work profile. There, the targeted fix is 'Retire the inappropriate enrollment and re-enroll using approved personally owned work-profile setup.' because full management can exceed the organization's permitted control over employee devices. The current scenario instead requires 'Configure Microsoft Intune MDM user scope and required automatic enrollment prerequisites.' and verification that a newly joined authorized Windows laptop appears as an Intune managed device after sign-in.

This action is appropriate for a different case: A device is registered in Windows Autopilot but not yet managed and a service desk mistakes the record for an enrolled Intune endpoint. There, the targeted fix is 'Distinguish the Autopilot inventory identity from a managedDevice enrollment record.' because pre-registration and actual MDM enrollment are separate lifecycle stages. The current scenario instead requires 'Configure Microsoft Intune MDM user scope and required automatic enrollment prerequisites.' and verification that a newly joined authorized Windows laptop appears as an Intune managed device after sign-in.

This action is appropriate for a different case: A user enrolls a second Windows machine and receives an Intune maximum device count failure. There, the targeted fix is 'Check enrollment device limits and approved user quota rather than deleting unrelated devices.' because a device-count restriction is different from an app deployment error. The current scenario instead requires 'Configure Microsoft Intune MDM user scope and required automatic enrollment prerequisites.' and verification that a newly joined authorized Windows laptop appears as an Intune managed device after sign-in.

This action is appropriate for a different case: Company-owned Android tablets must run only a warehouse scanning application with no employee user account. There, the targeted fix is 'Configure Android Enterprise dedicated-device enrollment and a supported kiosk profile.' because dedicated enrollment is designed for purpose-built company-owned Android devices. The current scenario instead requires 'Create separate BYOD and corporate enrollment models with the appropriate privacy and supervision behavior.' and verification that the personal device enrolls with user-appropriate controls while the corporate device is supervised.

This action is appropriate for a different case: A field team reports enrollment failures only on outdated Android versions not supported by the corporate platform baseline. There, the targeted fix is 'Apply documented platform minimum-version enrollment restrictions and communicate upgrade requirements.' because enrollment requirements must match the supported operating-system policy. The current scenario instead requires 'Create separate BYOD and corporate enrollment models with the appropriate privacy and supervision behavior.' and verification that the personal device enrolls with user-appropriate controls while the corporate device is supervised.

This action is appropriate for a different case: A device is registered in Windows Autopilot but not yet managed and a service desk mistakes the record for an enrolled Intune endpoint. There, the targeted fix is 'Distinguish the Autopilot inventory identity from a managedDevice enrollment record.' because pre-registration and actual MDM enrollment are separate lifecycle stages. The current scenario instead requires 'Create separate BYOD and corporate enrollment models with the appropriate privacy and supervision behavior.' and verification that the personal device enrolls with user-appropriate controls while the corporate device is supervised.

This action is appropriate for a different case: An Intune compliance policy for Android expects a Windows-only setting and shows unknown evaluations. There, the targeted fix is 'Assign platform-specific compliance settings only to supported operating systems.' because compliance criteria are not interchangeable across device platforms. The current scenario instead requires 'Integrate Defender device risk signals into Intune compliance and enforce the result through Entra Conditional Access.' and verification that a high-risk test endpoint becomes noncompliant and fails the intended access policy.

This action is appropriate for a different case: A regional administrator accidentally modifies another unit's Windows 365 provisioning policy because their administrative rights are global. There, the targeted fix is 'Scope Windows 365 and Intune administrative roles to the intended administrative boundary.' because Cloud PC rights should follow the same minimum-access governance as physical devices. The current scenario instead requires 'Integrate Defender device risk signals into Intune compliance and enforce the result through Entra Conditional Access.' and verification that a high-risk test endpoint becomes noncompliant and fails the intended access policy.

This action is appropriate for a different case: A help desk wants access to users' local administrator passwords but all workstations share one manually assigned value. There, the targeted fix is 'Deploy Windows LAPS policy through Intune and back up unique device passwords to the approved directory.' because unique rotating administrator secrets reduce lateral movement risk. The current scenario instead requires 'Integrate Defender device risk signals into Intune compliance and enforce the result through Entra Conditional Access.' and verification that a high-risk test endpoint becomes noncompliant and fails the intended access policy.

This observation would validate a different case: An administrator uses an Intune app assignment filter to include a device whose OS version does not support the app's minimum requirement. It would check 'Supported endpoints install and incompatible ones are reported as not applicable.' after 'Use supported app applicability rules plus appropriate assignment filters.'. It does not establish success for the stated scenario; the needed evidence is 'A sampled Office installation reports the intended channel after policy takes effect.'.

This observation would validate a different case: A user complains that an optional productivity tool installs on every corporate phone without consent. It would check 'The pilot user chooses whether to install the optional app from the approved portal.' after 'Change the Intune app assignment from Required to Available where appropriate.'. It does not establish success for the stated scenario; the needed evidence is 'A sampled Office installation reports the intended channel after policy takes effect.'.

This observation would validate a different case: A Microsoft Store application has been delisted and a policy still targets its unavailable listing. It would check 'The replacement app package installs on pilot endpoints and no stale Store reference remains.' after 'Check current Store availability and switch to a supported enterprise packaging source if licensed.'. It does not establish success for the stated scenario; the needed evidence is 'A sampled Office installation reports the intended channel after policy takes effect.'.

This observation would validate a different case: A legacy Group Policy has hundreds of settings and IT needs to know which can move to modern device management. It would check 'A migration report distinguishes supported controls from ones needing redesign.' after 'Use Group Policy analytics to import and assess supported settings migration paths.'. It does not establish success for the stated scenario; the needed evidence is 'Supported macOS pilots enforce the control while incompatible versions are explicitly documented.'.

This observation would validate a different case: Windows accessibility settings must stay usable, but a security configuration profile unintentionally disables all assistive technology. It would check 'Screen-reader workflow works on the pilot while required security controls still apply.' after 'Adjust only the conflicting setting within a scoped policy after accessibility testing.'. It does not establish success for the stated scenario; the needed evidence is 'Supported macOS pilots enforce the control while incompatible versions are explicitly documented.'.

This observation would validate a different case: An organization needs a new ADMX-backed policy in Intune that is not yet included in its ordinary settings catalog. It would check 'The policy applies to supported Windows pilot devices and reports an effective value.' after 'Import the supported ADMX definition and publish the associated configuration settings.'. It does not establish success for the stated scenario; the needed evidence is 'Supported macOS pilots enforce the control while incompatible versions are explicitly documented.'.

This action is appropriate for a different case: A remote kiosk is frozen after an application update and operations needs a controlled reboot, not a factory reset. There, the targeted fix is 'Use the Restart remote device action with authorization and user-impact assessment.' because restart and wipe have drastically different data effects. The current scenario instead requires 'Use a validated static snapshot or controlled approval gate for high-impact bulk targeting.' and verification that an audit shows approved target IDs exactly match executed actions in a safe test.

This action is appropriate for a different case: A KQL device query is returning no rows because the administrator copied a Log Analytics table name not available in Intune device query. There, the targeted fix is 'Use the device query supported schema and validate KQL syntax against its data model.' because KQL environments have different tables and available properties. The current scenario instead requires 'Use a validated static snapshot or controlled approval gate for high-impact bulk targeting.' and verification that an audit shows approved target IDs exactly match executed actions in a safe test.

This action is appropriate for a different case: Hundreds of managed devices need a common remote restart after a validated firmware change. There, the targeted fix is 'Use supported Intune bulk remote action with carefully verified group/device selection.' because bulk actions can multiply mistakes unless scoping is explicit. The current scenario instead requires 'Use a validated static snapshot or controlled approval gate for high-impact bulk targeting.' and verification that an audit shows approved target IDs exactly match executed actions in a safe test.

This observation would validate a different case: An app catalog entry becomes available to the wrong security group and contractors download a licensed finance tool. It would check 'The finance test user can install the tool and contractor accounts cannot see it.' after 'Correct required/available assignment and group exclusions to enforce app entitlement.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot installation sequences the restart safely and later installs the main app.'.

This observation would validate a different case: An administrator uses an Intune app assignment filter to include a device whose OS version does not support the app's minimum requirement. It would check 'Supported endpoints install and incompatible ones are reported as not applicable.' after 'Use supported app applicability rules plus appropriate assignment filters.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot installation sequences the restart safely and later installs the main app.'.

This observation would validate a different case: An internal line-of-business Windows app uses an MSI package and needs quiet installation across managed PCs. It would check 'An enrolled Windows pilot receives the MSI and the application launches successfully.' after 'Deploy the application using the appropriate Intune LOB/Win32 app packaging approach.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot installation sequences the restart safely and later installs the main app.'.

This observation would validate a different case: A field device is configured for hybrid join though it never has a reliable route to domain controllers during the first boot. It would check 'An off-network pilot completes the chosen supported join workflow without domain dependency failure.' after 'Select an appropriate cloud-native Entra join deployment or plan validated domain connectivity.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot Cloud PCs use the new approved network while existing users remain on their prior policy.'.

This observation would validate a different case: A service desk wants to reset a problematic Autopilot-managed Windows laptop while preserving its approved management state. It would check 'After pilot reset the device returns to the expected managed ready state.' after 'Choose a supported Windows Autopilot reset or reprovisioning action suited to the deployment model.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot Cloud PCs use the new approved network while existing users remain on their prior policy.'.

This observation would validate a different case: Windows laptops remain on an unsupported Windows 10 release while hardware meets the organization’s Windows 11 requirements. It would check 'A pilot fleet reports the intended Windows 11 version and user applications remain functional.' after 'Plan an eligible Windows 11 upgrade using Intune feature update policies and readiness checks.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot Cloud PCs use the new approved network while existing users remain on their prior policy.'.

This observation would validate a different case: A protected iOS app shows a user-facing error because its app protection SDK integration is not supported by the installed app version. It would check 'The updated compatible app receives and enforces the intended policy.' after 'Verify the app's Intune MAM compatibility and deploy a supported build.'. It does not establish success for the stated scenario; the needed evidence is 'The protected supported app connects and an unprotected native app cannot access mail.'.

This observation would validate a different case: A managed Android app receives a configuration key from a public email rather than through controlled policy. It would check 'The app reads its approved endpoint and tenant options without exposing them in user emails.' after 'Create an Intune app configuration policy using supported managed app configuration settings.'. It does not establish success for the stated scenario; the needed evidence is 'The protected supported app connects and an unprotected native app cannot access mail.'.

This observation would validate a different case: A new Teams app version is installed, but app protection appears inactive because a stale user account is signed in. It would check 'Switching to the targeted work account activates the intended data protection controls.' after 'Check which organizational identity and supported app instance is receiving the policy.'. It does not establish success for the stated scenario; the needed evidence is 'The protected supported app connects and an unprotected native app cannot access mail.'.